CVE-2020-12257: CSRF
Published May 18, 2020
·Updated
rConfig 3.9.4 is vulnerable to cross-site request forgery (CSRF) because it lacks implementation of CSRF protection such as a CSRF token. An attacker can leverage this vulnerability by creating a form (add a user, delete a user, or edit a user).
Affected Software
1 affected component
rConfig rConfig=3.9.4
Event History
May 18, 2020
CVE Published
via MITRE·01:51 PM
Data Sourced
via MITRE·01:51 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for rConfig 3.9.4?
The vulnerability ID for rConfig 3.9.4 is CVE-2020-12257.
2
What is the severity of CVE-2020-12257?
The severity of CVE-2020-12257 is high with a severity score of 8.8.
3
What is the affected software for CVE-2020-12257?
The affected software for CVE-2020-12257 is rConfig 3.9.4.
4
What is the vulnerability description of CVE-2020-12257?
CVE-2020-12257 is a cross-site request forgery (CSRF) vulnerability in rConfig 3.9.4.
5
How can an attacker exploit CVE-2020-12257?
An attacker can exploit CVE-2020-12257 by creating a form to perform unauthorized actions on the affected rConfig 3.9.4 instance.